org.nuxeo.ecm.platform.ui.web.auth

Class NuxeoAuthenticationFilter

java.lang.Object

org.nuxeo.ecm.platform.ui.web.auth.NuxeoAuthenticationFilter

All Implemented Interfaces:

javax.servlet.Filter

public class NuxeoAuthenticationFilter
extends Object
implements javax.servlet.Filter

Servlet filter handling Nuxeo authentication (JAAS + EJB).

Also handles logout and identity switch.

Author:

Thierry Delprat, Bogdan Stefanescu, Anahide Tchertchian, Florent Guillaume

Field Summary

Fields

Modifier and Type	Field and Description
protected boolean	avoidReauthenticate
protected boolean	byPassAuthenticationLog On WebEngine (Jetty) we don't have JMS enabled so we should disable log
protected com.codahale.metrics.Counter	concurrentCount
protected com.codahale.metrics.Counter	concurrentMaxCount
static String	DEFAULT_START_PAGE
protected static Principal	DIRECTORY_ERROR_PRINCIPAL Used internally as a marker.
protected static Boolean	isLoginSynchronized
static String	LOGIN_DOMAIN LoginContext domain name in use by default in Nuxeo.
protected static String	LOGIN_JMS_CATEGORY
protected com.codahale.metrics.Counter	loginCount
protected com.codahale.metrics.MetricRegistry	registry
protected com.codahale.metrics.Timer	requestTimer
protected String	securityDomain Which security domain to use
protected PluggableAuthenticationService	service
protected List<String>	unAuthenticatedURLPrefix
protected ReentrantReadWriteLock	unAuthenticatedURLPrefixLock
protected static String	XMLHTTP_REQUEST_TYPE

Constructor Summary

Constructors

Constructor and Description
NuxeoAuthenticationFilter()

Method Summary

Modifier and Type	Method and Description
protected boolean	bypassAuth(javax.servlet.http.HttpServletRequest httpRequest)
void	destroy()
protected Principal	doAuthenticate(CachableUserIdentificationInfo cachableUserIdent, javax.servlet.http.HttpServletRequest httpRequest)
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void	doFilterInternal(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
protected void	doInitIfNeeded()
NuxeoAuthenticationPlugin	getAuthenticator(CachableUserIdentificationInfo ci)
protected static String	getRequestedPage(javax.servlet.http.HttpServletRequest httpRequest)
static String	getRequestedPage(javax.servlet.ServletRequest request)
static String	getRequestedUrl(javax.servlet.http.HttpServletRequest httpRequest)
protected static String	getSavedRequestedURL(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse)
protected boolean	handleLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse)
protected boolean	handleLogout(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, CachableUserIdentificationInfo cachedUserInfo)
protected UserIdentificationInfo	handleRetrieveIdentity(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse)
void	init(javax.servlet.FilterConfig config)
protected void	initUnAuthenticatedURLPrefix()
protected static boolean	isLoginSynchronized()
protected boolean	isStartPageValid(String startPage)
protected boolean	logAuthenticationAttempt(UserIdentificationInfo userInfo, boolean success)
static LoginContext	loginAs(String username) Does a forced login as the given user.
protected boolean	logLogout(UserIdentificationInfo userInfo)
protected boolean	needSessionSaving(UserIdentificationInfo userInfo)
protected void	propagateUserIdentificationInformation(CachableUserIdentificationInfo cachableUserIdent)
protected static CachableUserIdentificationInfo	retrieveIdentityFromCache(javax.servlet.http.HttpServletRequest httpRequest)
boolean	saveRequestedURLBeforeRedirect(javax.servlet.http.HttpServletRequest httpRequest, javax.servlet.http.HttpServletResponse httpResponse) Save requested URL before redirecting to login form.
protected static boolean	sendAuthenticationEvent(UserIdentificationInfo userInfo, String eventId, String comment)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

DEFAULT_START_PAGE

public static final String DEFAULT_START_PAGE

See Also:

Constant Field Values

LOGIN_DOMAIN

public static final String LOGIN_DOMAIN

LoginContext domain name in use by default in Nuxeo.

See Also:

Constant Field Values

XMLHTTP_REQUEST_TYPE

protected static final String XMLHTTP_REQUEST_TYPE

See Also:

Constant Field Values

LOGIN_JMS_CATEGORY

protected static final String LOGIN_JMS_CATEGORY

See Also:

Constant Field Values

isLoginSynchronized

protected static Boolean isLoginSynchronized

DIRECTORY_ERROR_PRINCIPAL

protected static final Principal DIRECTORY_ERROR_PRINCIPAL

Used internally as a marker.

avoidReauthenticate

protected final boolean avoidReauthenticate

See Also:

Constant Field Values

service

protected volatile PluggableAuthenticationService service

unAuthenticatedURLPrefixLock

protected ReentrantReadWriteLock unAuthenticatedURLPrefixLock

unAuthenticatedURLPrefix

protected List<String> unAuthenticatedURLPrefix

byPassAuthenticationLog

protected boolean byPassAuthenticationLog

On WebEngine (Jetty) we don't have JMS enabled so we should disable log

securityDomain

protected String securityDomain

Which security domain to use

registry

protected final com.codahale.metrics.MetricRegistry registry

requestTimer

protected final com.codahale.metrics.Timer requestTimer

concurrentCount

protected final com.codahale.metrics.Counter concurrentCount

concurrentMaxCount

protected final com.codahale.metrics.Counter concurrentMaxCount

loginCount

protected final com.codahale.metrics.Counter loginCount

Constructor Detail

NuxeoAuthenticationFilter

public NuxeoAuthenticationFilter()

Method Detail

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter

sendAuthenticationEvent

protected static boolean sendAuthenticationEvent(UserIdentificationInfo userInfo,
                                                 String eventId,
                                                 String comment)

logAuthenticationAttempt

protected boolean logAuthenticationAttempt(UserIdentificationInfo userInfo,
                                           boolean success)

logLogout

protected boolean logLogout(UserIdentificationInfo userInfo)

isLoginSynchronized

protected static boolean isLoginSynchronized()

doAuthenticate

protected Principal doAuthenticate(CachableUserIdentificationInfo cachableUserIdent,
                                   javax.servlet.http.HttpServletRequest httpRequest)

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

doFilterInternal

public void doFilterInternal(javax.servlet.ServletRequest request,
                             javax.servlet.ServletResponse response,
                             javax.servlet.FilterChain chain)
                      throws IOException,
                             javax.servlet.ServletException

Throws:

IOException

javax.servlet.ServletException

getAuthenticator

public NuxeoAuthenticationPlugin getAuthenticator(CachableUserIdentificationInfo ci)

retrieveIdentityFromCache

protected static CachableUserIdentificationInfo retrieveIdentityFromCache(javax.servlet.http.HttpServletRequest httpRequest)

doInitIfNeeded

protected void doInitIfNeeded()
                       throws javax.servlet.ServletException

Throws:

javax.servlet.ServletException

init

public void init(javax.servlet.FilterConfig config)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

saveRequestedURLBeforeRedirect

public boolean saveRequestedURLBeforeRedirect(javax.servlet.http.HttpServletRequest httpRequest,
                                              javax.servlet.http.HttpServletResponse httpResponse)

Save requested URL before redirecting to login form.

Returns true if target url is a valid startup page.

getRequestedUrl

public static String getRequestedUrl(javax.servlet.http.HttpServletRequest httpRequest)

getSavedRequestedURL

protected static String getSavedRequestedURL(javax.servlet.http.HttpServletRequest httpRequest,
                                             javax.servlet.http.HttpServletResponse httpResponse)

isStartPageValid

protected boolean isStartPageValid(String startPage)

handleLogout

protected boolean handleLogout(javax.servlet.ServletRequest request,
                               javax.servlet.ServletResponse response,
                               CachableUserIdentificationInfo cachedUserInfo)
                        throws javax.servlet.ServletException

Throws:

javax.servlet.ServletException

propagateUserIdentificationInformation

protected void propagateUserIdentificationInformation(CachableUserIdentificationInfo cachableUserIdent)

initUnAuthenticatedURLPrefix

protected void initUnAuthenticatedURLPrefix()

bypassAuth

protected boolean bypassAuth(javax.servlet.http.HttpServletRequest httpRequest)

getRequestedPage

public static String getRequestedPage(javax.servlet.ServletRequest request)

getRequestedPage

protected static String getRequestedPage(javax.servlet.http.HttpServletRequest httpRequest)

handleLoginPrompt

protected boolean handleLoginPrompt(javax.servlet.http.HttpServletRequest httpRequest,
                                    javax.servlet.http.HttpServletResponse httpResponse)

handleRetrieveIdentity

protected UserIdentificationInfo handleRetrieveIdentity(javax.servlet.http.HttpServletRequest httpRequest,
                                                        javax.servlet.http.HttpServletResponse httpResponse)

needSessionSaving

protected boolean needSessionSaving(UserIdentificationInfo userInfo)

loginAs

public static LoginContext loginAs(String username)
                            throws LoginException

Does a forced login as the given user. Bypasses all authentication checks.

Parameters:

username - the user name

Returns:

the login context, which MUST be used for logout in a finally block

Throws:

LoginException